Threat identification and mitigation in computer mediated communication, including online social network environments

ABSTRACT

A method for combating electronic communication that may cause an individual to adopt extremist or terrorist philosophies. The method comprises intercepting electronic communication intended for or initiated by the individual over an Internet communication medium, identifying electronic communication, as intercepted, that relate to extremist or terrorist philosophies, analyzing content of the electronic communication that relates to extremist or terrorist philosophies, injecting counter-narrative content to the individual&#39;s communication stream to counter determined content, and displaying text associated with one or more of the method steps on a display screen.

CLAIM OF PRIORITY

This application claims priority under 35 U.S.C. section 119(e) to theU.S. Provisional Patent Application assigned application No. 61/433,221entitled Understanding and Combating Radicalization and Recruitment intoExtremist/Terrorist Groups in Online Social Network Environments andfiled on Jan. 15, 2011, the entire contents of which are herebyincorporated by reference.

FIELD OF THE INVENTION

The various embodiments of this invention relate to apparatuses andmethods for identifying terrorist threats and mitigating those threatsthrough the use of computer-mediated communication, includingcommunication through online social networks.

BACKGROUND OF THE INVENTION

The present invention centers on monitoring computer-mediatedcommunication (CMC) toward identifying potential threats and implantingmitigating content to counter the ongoing narrative of thegroup/individual. The primary target of this invention is the monitoringof extremist/terrorist CMC toward the identification of patterns ofradicalization and recruitment, the identification of threats based uponthe findings of multi-variable threat matrix, and the implementation ofcounter-narrative messaging to dissuade users from becoming radicalized.

As western counter-terrorism efforts have limited the variousperson-to-person avenues for the spread of extremist ideology byoutlawing ‘hate-speech’ in public forums, mosques, and in print, as wellas identifying and arresting known terrorist recruiters, thesecommunications have been driven underground and the investment byextremist groups in on-line forums and websites, and the level ofparticipation within these websites, has grown substantially.Increasingly, those arrested on suspicion of terrorism or those actuallyengaging in terrorist acts indicate they began their ‘journey’ byvisiting extremist websites, participating in chat rooms, and watchingextremist and/or jihadi videos.

Current research suggests that behavior modification is possible viahuman-computer interaction. Further, the ability to socially interact onthe computer has evolved to the level of real-time communications. Thisallows for iterative computer mediated dialogue to be considered anequal to face-to-face communication. This change in perception iscritical to understanding the interactive effect of extremist websites,online social networks, and other CMC on individuals consideredvulnerable to extremist radicalization.

The potential danger of online radicalization is highlighted in theUnited Kingdom's Strategy for Countering International Terrorism (March2009). Noted within this document is the threat posed by “self-startingnetworks, or even lone individuals, motivated by an ideology similar tothat of Al-Qaeda, but with no connection to that organization; andterrorist groups that follow a broadly similar ideology as Al-Qaeda butthat have their own identity and regional agenda.” Further, the documentacknowledges the role and impact of the internet in the “two waydialogue between their organizations and their actual or prospectivemembers . . . that enables fundraising, recruitment, and some trainingand operational planning.” Previous action by far-right/anti-immigrationgroups and recent calls by extremist Islamists to move out of theirpassword protected chat-rooms and expand onto social network sites likeFacebook and Twitter in order to ‘appeal to the masses’, just as theyhave used YouTube to spread extremist propaganda, is a disturbingdevelopment given the trend of online radicalization seen in recentarrests.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a functional block diagram of an apparatus for determiningmonitoring electronic communication and injecting counter-narrativecontent as appropriate.

FIG. 2 is a block diagram of a computer system for use in practicing theinvention.

FIG. 3 is a flow diagram of monitoring and interdicting steps accordingto the present invention.

DETAILED DESCRIPTION OF INVENTION

Before describing in detail the particular apparatuses and methods foridentifying threats and mitigating those threats through the use ofcomputer-mediated communication, in accordance with the variousembodiments of the present invention, it should be observed that theseembodiments reside primarily in a novel combination of hardware andsoftware elements related to the claimed apparatuses and methods.Accordingly, the hardware and software elements have been represented byconventional elements in the drawings, showing only those specificdetails that are pertinent to the presented embodiments, so as not toobscure the disclosure with details that will be readily apparent tothose skilled in the art having the benefit of the description herein.

The following embodiments are not intended to define limits as to thestructures or methods of the invention but only to provide exemplaryconstructions. The embodiments are permissive rather than mandatory andillustrative rather than exhaustive.

Generally, the embodiments of the present invention analyze multiplevariables to determine how computer-mediated communication canfacilitate radicalization and formal recruitment into an extremistorganization, where such organizations are known to or suspected ofcarrying out terrorist actions against countries, cultures or religiousorganizations having views (e.g., religious or cultural) that areanathema to the organization. These variables may include, but are notbe limited to:

(1) An individual's patterns of participation in such an organization,including exposure to the narratives of the organization and the periodof social learning about the organization. When an individual firstbegins to visit/interact with a new online environment there is a periodof social learning (also known as lurking) during which the individualsimply observes the group activity to learn the nomenclature and theagenda of the group. Social learning is necessary so the individualparticipant does not ‘say’ something that might get him/hersanctioned/removed from the group. This period of social learning islikely the most effective time for interdiction as there has beeninsufficient time for assimilation with the group narrative.

(2) Development of the individual's social network as related toextremist/terrorist activities, including identifying facilitators andrecruiters within those networks. Facilitators/recruiters are identifiedusing social network analysis that indicates those individuals that actas communication hubs within the group. It is known through theinventor's ongoing analysis that within the membership of the groupsthere is a core of participants who account for the majority of theonline activity to disseminate the group narrative and interact with thegeneral membership. Of the groups studied, these facilitators, whoaccount for the majority of the traffic, represent about 1-2% of theentire membership.

(3) Examining changes in the individual's dialog over time as thosechanges reflect identification with and acceptance of an extremistnarrative. This examination includes an analysis of the use of keywords/phrases that indicate an acceptance of the group's narrative,comments concerning or sharing of URL (uniform resource locator) linksthat espouse the group's narrative and engagement (e.g., electroniccommunications) with other members regarding ideological issues.

(4) Linking the extremist dialog with socio-political events/triggers orwith exposure to certain extremist content, links or facilitators.Certain events that impact the group (legislation, attacks, arrests,etc.) will provoke a reaction from individuals within the group or thathave a connection with that group. Further, how the individual respondsto contact with URL links, other extremist content, and facilitatorsprovides a measure of the individual's acceptance of and identificationwith the extremist narrative. Ongoing research by the inventor indicatesthat only a subset of 6-7% of the overall membership actually engage inan ongoing dialog within other group members, and a small subset withinthis subset engage on a regular basis with other group members. Thissmall subset is the target of such analysis.

(5) Determining the impact of the content associated with embedded URLlinks on the group and individual narrative and the nature of thecontent, e.g., motivational or operational. Responses to the URL links,which most often are presented in such a way as to build groupsolidarity by either reinforcing the group narrative or furthering theus-vs-them paradigm of the membership. The simple fact that anindividual responds to these links is significant and the content ofthat response, which indicates an acceptance or rejection of thenarrative, provides a useful measure.

(6) Identifying patterns of radicalization and recruitment within thenetwork.

(7) Identifying points along the radicalization continuum where targetedcounter messaging is most effective. These messages includecounter-narrative and/or persuasive messages to discourage or dissuadethe individual from continued group participation in the group. Thesystem of the invention identifies key points within the individual'sparticipation pattern where these interdictions should be mosteffective. System triggers for this automated implantation include butare not limited to, use of certain key words/phrases; interaction withcertain individuals/facilitators that are known to be the mostinfluential within the group; and posting of traffic that would indicatea questioning of the group narrative (interdictions in this case wouldserve to reinforce those doubts and move the individual away from thegroup).

(8) Identifying a “tipping point”, via a multi-variable threat matrix,at which point intervention with counter messages is no longereffective. Ongoing research indicates that the multi-variable threatmatrix would include the cumulative/integrated results of the trafficanalysis (how often the individual participates within the group);continued contact with extremist URL links and knownfacilitators/recruiters; and the increased use of key words/phrases thatindicate an acceptance of and identification with the group narrativethat would include the use of words/phrases that reveal an indication ofpending violent action through the change of agency in the words/phrasesbeing used. An example of a change of agency can be seen when someoneshifts from making statement like, “I wish those people would just goaway”, to stating, “I want to kill those people.”

The present invention analyzes the impact of the electroniccommunication stream and the development of the extremist narrative andits component parts, as reflected in the discourse within thecomputer-mediated communication, by using collection and analyticaltools that facilitate a multi-level cascading statistical analysis ofthe collected information.

Further, the invention includes an integrated messaging component thatallows implantation of counter-narrative messages/interdictions withinthe CMC stream and the ability to measure the impact of those messageson the users. This function is currently designed to automaticallyimplant these messages when the individual uses certain key/words andphrases. Further, contact with certain content or individuals thatincludes but is not limited to extremist URL links, andfacilitators/recruiters can also trigger prepared counter-messages thatare context-specific and stored within the system. As an example, if anindividual who is participating within a jihadi site comes in contactwith a video of an Anwar al-Awlaki sermon, a previously-prepared countermessage by a well known Islamic scholar would be sent to counter theinfluence of the Awlaki video and create doubt within the individual andthe group.

The hardware/software components of the invention automatically monitorcomputer mediated communications to identify, analyze and attempt todetermine the effect of these communications on the individual, identifythose individuals who are most susceptible to this persuasion, andimplant automated interdictions that allow for the deceleration of theindividual identification with the narrative of the group they areengaged with. The nature, content and frequency of the counter-narrativeinterdictions can be tailored based on the degree to which theindividual has adopted the group's extremist or terrorist narrativeand/or the individual's susceptibility to persuasion by other members ofthe group.

In the realm of extremist groups, the system monitors thecomputer-mediated communication of these groups and individuals,identifies those individuals who are on the path to accepting theextremist narrative (by evaluating the level and extent of theirparticipation within the group, their use of key words/phrases thatindicate an identification with and acceptance of the extremistnarrative, and their increased participation/interaction with knownfacilitators/recruiters). The system provides automated interdictions(i.e., mitigating content or counter-narrative messages) that seek todissuade these individuals from continuing along this path. The systemincludes metrics, based upon the individuals interaction with andresponse to the implantation, including the analysis of the responsecontent and whether the individual shares this content with others oruses it in future CMS's, to determine whether these interdictions areeffective and if the individual's identification with the extremistnarrative continues unabated and reaches a point of no return within thepredetermined multi-variant threat matrix. At this point the systemidentifies the individual as a potential threat and places him/her on alist for more individual investigation.

This system allows for the monitoring and interdiction of hundreds ofgroups at any given time, in real time, and therefore provides asignificant reduction in current man-hours required to monitor thesesame groups.

Data Collection/Processing

Data collection and analysis is performed on a live data stream in realtime. Current collection and analysis rates are estimated at 40gigabytes/second. The invention is designed to allow for the applicationof the functions previously mentioned for various usages. This is madepossible by the establishment of the “plug and play” capabilities of thedevice. The end user of the data collection device determines the groupsto be monitored and the key determinants of participation, interaction,and key words and phrases that the system will use to conduct theanalysis. The implementation of a graphical user interface allows theuser to input the initial analysis parameters. This functionality alsoallows for the continued modification or addition of critical searchinformation as group dynamics change. Based upon the user input, thedevice provides group-specific monitoring, analysis, and threatidentification.

It is important to note that the term ‘computer mediated communication’(CMC) is not limited to communications only from/by/to computers. Theability to engage in CMC from mobile devices, which includes but is notbe limited to, cell phones, PDA's, iPad's, etc., and the ability of thesystem to monitor these communications, extends the capability of thesystem to detect threats within CMC originating from/involving multiplecommunications platforms.

Data Analysis

To understand the potential influencing factors within thesecommunications, particularly within and extremist/terrorist environment,several separate analyses are performed simultaneously on the datastream. These include a network analysis, e.g., an analysis of anindividual's network of friends/associates and his/her communicationsbetween and among those friends, and an identity of those in thecommunications network. This process also allows for the identificationof facilitators within the social network, content or discourseanalysis, and an analysis of the URL links found within thecomments/posts.

Key to understanding the long term effect of exposure to the extremistnarrative within these groups, the network and content analyses can belinked to determine how discourse may change over time to indicateassimilation and identification with the radical ideology/narrative.Additionally, the content analysis is used to understand the influenceof URL links within the posts, email, instant messages or text messages.Lastly, the individual URL links are analyzed to consider their virilityand effectiveness as persuasive agents. The URL's are a key tounderstanding the persuasive nature of the information (for examplevideo's) within the group. If a particular video/link is associated withan uptick in aggressive/flaming dialogue (which is an indicator ofincreased acceptance of the extremist narrative) it is then possible todevelop counter-narrative links and messages to offset the influencingnature of that particular video/link.

FIG. 1 depicts the functioning of a monitoring and interdiction system10 of the present invention. Generally, FIG. 1 is a visualrepresentation of operation of the monitoring, interdiction, threatidentification product of the present invention. Computer mediatedcommunications are subjected to a multi-variable analysis. Thecharacteristics of the individual's participation is measured todetermine the need for the implantation of targeted messaging and thelevel of messaging required. The continued responses from the userdictate the level of targeted interdiction by the system as the feedbackloop that allows the system to measure the effectiveness of previousinterdictions.

A measuring function also allows the system to determine when a user'sonline dialogue/usage has reached a point of serious concern based upona predetermined multi-variable threat matrix. Once this “tipping point”is reached the individual is identified as a possible threat for moredetailed consideration.

The system 10 accesses electronic communication occurring over theInternet 14. A functional block 18 conducts a multi-variable analysis ofthe electronic communication, including analysis of traffic patterns,user networks, social network structure elements, impact of knownfacilitators, identified URL links, URL links that have been accessedand extremist/terrorist content within the electronic communication. Afunctional block 30 receives the results from the block 18 and measurescharacteristics of an individual's participation within the CMCenvironment based on one or more factors described above, e.g., contentof initiated emails and instant messages, web sites visited, association(frequency of communication and nature of that communication) with othergroup members who have adopted the extremist narrative.

Once the system has determined the degree to which the target narrativehas been adopted within the functional block 30, a block 34 evaluatesavailable counter-narratives and persuasive content for rebutting thetarget extremist narrative with respect to the individual and the CMCstream. At a block 38 the counter-narrative and persuasive messages areprepared for inputting into the individual's data stream (e.g., throughemails, text messages, instant messages, invitations to web sitespresenting the counter-narrative). A computer mediated communicationelement 42 inputs the counter-narrative content to the individual's datastream on the Internet 14, such as by sending emails, text messages,instant messages or URL links.

A functional block 46 monitors an individual's progression along theradicalization continuum and identifies any such individuals who haveprogressed “beyond the tipping point” within a predefined multi-variablethreat matrix to a functional block 50.

Data flow paths 60 and 62 depict publicly-available data flows.

While this system/device was originally designed for the monitoring,analysis, and threat identification within extremist/terrorist computermediated communication, it also has conventional commercialapplications. These include, but are not limited to: The monitoring ofcommunications within a network for corporate threats. These mayinclude, but are not be limited to:

-   -   a. E-mails or downloads from within or without that may contain        viruses/bots that may be considered threats to the network.    -   b. Communications from within or without the network that        indicates activity related to corporate espionage.    -   c. Access within the network to highly sensitive information by        individuals/systems from within or without the network who are        not authorized to access such information.        Note: The system identification of certain key words/phrases        within CMC's as well as contact with certain known threats would        trigger an alert. Further, unauthorized access to files would be        facilitated by the linkage of a ‘cleared list’ and/or a ‘no        copies order’ to the monitoring/search function of the system to        identify anyone engaging in unauthorized access/copying of        sensitive material.

The monitoring of electronic communication to identify threats tocorporate brands. Brand protection is essential in the corporate worldand the identification of threats to these brands within CMC/cyberspacecan prove invaluable, given the ability of the system to provide realtime identification of these threat to allow for mitigation before theinformation reaches critical mass (i.e., goes “viral”).

Law enforcement officials can monitor criminal networks or simplymonitor CMC to look for criminal activity/planning within the CMCcommunication stream. These analytics can be used as an investigativetool. Additionally, the findings can potentially be used as evidence oras a manner of truth detection when questioning suspects.

The military can use the system ‘in theater’ to measure the potentialfor threats in a given area by monitoring the CMC within that area.

This hardware/software can allow political campaigns to monitor onlinecommunications within public forums toward identifying threats to theircandidate/cause, very similar to the corporate brand protection paradigmdescribed above.

This system provides an in-depth analysis of computer mediatedcommunication toward the identification of threats within apredetermined multi-variable threat matrix. It also includes the abilityto implant targeted content to counter the ongoing narrative, andmeasure the impact of that content on the users and the ongoing streamof CMC.

Systems/software for collecting and analyzing the data has considerablepotential as a valuable tool in social science research. Further, theanalysis fills a huge gap in terrorism studies literature regardingunderstanding the influence/role of extremist social networking sites inthe radicalizing process.

These processes are also useful in understanding the use of thesetechniques in product marketing as well as in the area of politicalpersuasion in legitimate political campaigns. Social networking andcomputer-mediated communication are becoming an integral part of westernlife with research and system just now beginning to understand the trueimpact and persuasive nature of these interactions on the individual.

It is clear that extremist/terrorist groups are utilizing computermediated communication including social networking sites like Facebookand Twitter (to name just a few) to radicalize vulnerable individualsand build a pool of recruits. The ability to counter these effortsshould be considered an integral part of combating terrorism, and morespecifically combating the efforts to create “homegrown terrorists.”

Broadly speaking, the invention teaches a method, apparatus, and programfor determining extremist or terrorist philosophies in electroniccommunication and combating those philosophies by interdictivecounter-narratives. To facilitate an understanding of the presentinvention, it is described with reference to specific implementationsthereof.

The embodiments of the present invention may be implemented in thegeneral context of computer-executable instructions, such as programmodules executed by a computer. Generally, program modules includeroutines, programs, objects, components, data structures, etc. thatperform particular tasks or implement particular abstract data types.For example, the software programs that underlie the invention can becoded in different languages for use with different platforms. Theprinciples that underlie the invention can be implemented with othertypes of computer software technologies as well.

Moreover, those skilled in the art will appreciate that the inventionmay be practiced with other computer system configurations, includinghand-held devices, multiprocessor systems, microprocessor-based orprogrammable consumer electronics, minicomputers, mainframe computers,and the like. The invention may also be practiced in distributedcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed computing environment, program modules may be located inboth local and remote computer storage media including memory storagedevices.

Persons skilled in the art will recognize that an apparatus, such as adata processing system, including a CPU, memory, I/O, program storage, aconnecting bus, and other appropriate components, could be programmed orotherwise designed to facilitate the practice of the method of theinvention. Such a system would include appropriate program features forexecuting the method of the invention.

Also, an article of manufacture, such as a pre-recorded disk or othersimilar computer program product, for use with a data processing system,could include a storage medium and a program stored thereon fordirecting the data processing system to facilitate the practice of themethod of the invention. Such apparatus and articles of manufacture alsofall within the spirit and scope of the invention.

The present invention can be embodied in the form ofcomputer-implemented processes and apparatuses for practicing thoseprocesses. The present invention can also be embodied in the form ofcomputer program code containing computer-readable instructions embodiedin tangible media, such as floppy diskettes, CD-ROMs, hard disks, flashdrives or any other computer-readable storage medium, wherein, when thecomputer program code is loaded into and executed by a computer orprocessor, the computer or processor becomes an apparatus for practicingthe invention. The present invention can also be embodied in the form ofcomputer program code, for example, whether stored in a storage mediumor loaded into and/or executed by a computer, wherein, when the computerprogram code is loaded into and executed by a computer or processor, thecomputer or processor becomes an apparatus for practicing the invention.When implemented on a general-purpose computer, the computer programcode segments configure the computer to create specific logic circuitsor processing modules.

FIG. 2 illustrates a computer system 100 for use in practicing theinvention. The system 100 can include multiple remotely-locatedcomputers and/or processors. The computer system 100 comprises one ormore processors 104 for executing instructions in the form of computercode to carry out a specified logic routine that implements theteachings of the present invention. The computer system 100 furthercomprises a memory 106 for storing data, software, logic routineinstructions, computer programs, files, operating system instructions,and the like, as is well known in the art. The memory 106 can compriseseveral devices, for example, volatile and non-volatile memorycomponents further comprising a random access memory RAM, a read onlymemory ROM, hard disks, floppy disks, compact disks including, but notlimited to, CD-ROM, DVD-ROM, and CD-RW, tapes, flash drives and/or othermemory components. The system 100 further comprises associated drivesand players for these memory types.

In a multiple computer embodiment, the processor 104 comprises multipleprocessors on one or more computer systems linked locally or remotely.According to one embodiment, various tasks associated with the presentinvention may be segregated so that different tasks can be executed bydifferent computers located locally or remotely from each other.

The processor 104 and the memory 106 are coupled to a local interface108. The local interface 108 comprises, for example, a data bus with anaccompanying control bus, or a network between a processor and/orprocessors and/or memory or memories. In various embodiments, thecomputer system 100 further comprises a video interface 120, one or moreinput interfaces 122, a modem 124 and/or a data transceiver interfacedevice 125. The computer system 100 further comprises an outputinterface 126. The system 100 further comprises a display 128. Thegraphical user interface referred to above may be presented on thedisplay 128. The system 100 may further comprise several input devices(not shown) including, but not limited to, a keyboard 130, a mouse 131,a microphone 132, a digital camera and a scanner (the latter two notshown). The data transceiver 125 interfaces with a hard disk drive 139where software programs, including software instructions forimplementing the present invention are stored.

The modem 124 and/or data receiver 125 can be coupled to an externalnetwork 138 enabling the computer system 100 to send and receive datasignals, voice signals, video signals and the like via the externalnetwork 138 as is well known in the art. The system 100 also comprisesoutput devices coupled to the output interface 126, such as an audiospeaker 140, a printer 142, and the like.

FIG. 3 is a flow chart 200 for implementation by the computer system 100of FIG. 2. The flowchart 200 begins at a step 202 where electroniccommunication intended for or initiated by the individual isintercepted. At a step 206 the intercepted electronic communication thatrelates to extremist or terrorist philosophies is identified. Thecontent of the electronic communication is analyzed at a step 210 todetermine the nature of the content, the senders and recipients,referenced URL links, etc. At a step 214 counter-narrative material isinjected into the individual's communication stream. The content of thecounter-narrative material is determined based on the content of theintercepted extremist/terrorist communication, with the intent ofcountering that content. Step 218, again using the results of the prioranalysis of the intercepted communication, attempts to determine whetherthe individual has progressed beyond a point of no return. Thisconclusion (which is not definitive given the nature of the contentanalysis, but merely provides an indication) is based upon apredetermined multi-variable threat matrix. It is surmised that once theindividual as reached this “tipping point” additional injections ofcounter-narrative content will have less effect on countering theextremist/terrorist content. Thus such content may be injected lessfrequently as indicated at a step 222. If the individual has not reachedthe “tipping point” the process continues to the step 202.

Social network sites or services referred to herein are typically onlineservice platforms or sites that focus on building and reflecting socialnetworks or social relations among people, who, for example, shareinterests and/or activities. A social network service consists of arepresentation of each user (often a profile), his/her social links, anda variety of additional services. Most social network services areweb-based and provide means for users to interact over the Internet,such as e-mail and instant messaging. Online community services aresometimes considered as a social network service, though in a broadersense, a social network service usually means an individual-centeredservice, whereas online community services are group-centered. Socialnetworking sites allow users to share ideas, activities, events, andinterests within their individual networks.

While the invention has been described with reference to variousembodiments, it will be understood by those skilled in the art thatvarious changes may be made and equivalent elements and process stepsmay be substituted for elements thereof without departing from the scopeof the present invention. The scope of the present invention furtherincludes any combination of the elements and process steps from thevarious embodiments set forth herein. In addition, modifications may bemade to adapt a particular situation to the teachings of the presentinvention without departing from its essential scope. Therefore, it isintended that the invention not be limited to the particular embodimentdisclosed as the best mode contemplated for carrying out this invention,but that the invention will include all embodiments falling within thescope of the appended claims.

1. A method for combating electronic communication that may cause anindividual to adopt extremist or terrorist philosophies, the methodcomprising: (a) intercepting electronic communication intended for orinitiated by the individual over an Internet communication medium; (b)identifying electronic communication, as intercepted according to step(a), that relate to extremist or terrorist philosophies; (c) analyzingcontent of the electronic communication that relates to extremist orterrorist philosophies as identified at step (b); (d) injectingcounter-narrative content to the individual's communication stream,responsive to content determined at step (c), to counter determinedcontent; and (e) displaying text associated with one or more of steps(a) through (d) on a display screen.
 2. The method of claim 1 whereinthe electronic communication comprises electronic mail, text messages,twitter tweats, instant messages, postings to web sites and informationon social networks.
 3. The method of claim 1 wherein step (b) furthercomprises determining content of URL links, text messages, emailmessages, instant messages, twitter tweats, postings to web sites, andinformation on social networks and attempting to identify a sender orposter of the electronic communication.
 4. The method of claim 1 whereinstep (c) further comprises comparing current content with prior contentto evaluate the individual's adoption of extremist or terroristphilosophies.
 5. The method of claim 1 further comprising determiningwhen an individual has entered a period of social learning about anorganization and responsive thereto executing step (d) by injectingcounter-narrative content into the individual's communication stream,wherein the counter-narrative content is responsive to the period ofsocial learning.
 6. The method of claim 1 further comprising:identifying a facilitator or recruiter exchanging electroniccommunication with the individual and through the electroniccommunication encouraging the individual to adopt extremist or terroristphilosophies; and conducting further analyses of the facilitator orrecruiter.
 7. The method of claim 1 further comprising determiningcontent of electronic communication related to extremist or terroristphilosophies and correlating the content with subsequent extremist orterrorist actions.
 8. The method of claim 7 further comprising injectingtargeted counter-narrative content into the individual's electroniccommunication stream to counter the content that leads to subsequentextremist or terrorist actions.
 9. The method of claim 1 furthercomprising determining identified elements of electronic communicationthat relate to extremist or terrorist philosophies for whichcounter-narrative content may be effective and injectingcounter-narrative content in response to the individual's exposure tothe identified elements of electronic communication.
 10. The method ofclaim 1 further comprising correlating counter-narrative content andelectronic communication content that relates to extremist or terroristphilosophies, and injecting correlated counter-narrative content intothe individual's electronic communication stream responsive toidentification of correlated electronic communication content thatrelates to extremist or terrorist philosophies.
 11. The method of claim1 wherein steps (a) through (d) are executed periodically.
 12. Themethod of claim 1 wherein step (a) further comprises accessing web sitesor accessing social network sites believed to espouse extremist orterrorist philosophies.
 13. The method of claim 1 wherein step (a)further comprising intercepting electronic communication initiated bythe individual for determining a degree to which the individual hasadopted extremist or terrorist philosophies.
 14. The method of claim 1wherein the step of intercepting is executed in real-time.
 15. Themethod of claim 1 further comprising determining that the individual hasprogressed beyond a “tipping point” based upon a predeterminedmulti-variable threat matrix at which time additional executions of step(d) have less effect on countering the determined content.
 16. Acomputer program product for executing by a computer, the computerprogram product for combating electronic communication that may cause anindividual to adopt extremist or terrorist philosophies, the computerprogram product comprising: computer readable program code modules forexecuting by the computer, the computer readable program code modulescomprising: a computer readable first program code module forintercepting electronic communication intended for or initiated by theindividual via a connection to an Internet communication medium; acomputer readable second program code module for identifying electroniccommunication, as intercepted according to the first program codemodule, that relate to extremist or terrorist philosophies; a computerreadable third program code module for analyzing content of theelectronic communication that relates to extremist or terroristphilosophies as identified by the second program code module; a computerreadable fourth program code module for injecting counter-narrativecontent to the individual's communication stream responsive to analyzedcontent as determined by the third program code module, thecounter-narrative content to counter the analyzed content; and acomputer readable fifth program code module for displaying textassociated with one or more of the first through fourth program codemodules, on a display screen.
 17. A computer system comprising: aprocessor; a display; a communications component for controllablyintercepting electronic communication intended for or initiated by anindividual over an Internet communication medium; the processor foridentifying and analyzing content of intercepted electroniccommunication related to extremist or terrorist philosophies; theprocessor for injecting counter-narrative content to a data stream ofthe individual to counter the content related to extremist or terroristphilosophies; and a display for displaying text associated with thecontent related to extremist or terrorist philosophies and thecounter-narrative content.